In a groundbreaking decision published today, the German anti-trust office (Bundeskartellamt) has ruled that Facebook must obtain consent before collecting data on users outside of the main Facebook social networking service.

German regulators ruled that Facebook’s use of additional services such as WhatsApp, Instagram, Facebook Analytics, and social buttons to collect data on users while away from the main site is illegal and should be prohibited for the sake of fair competition among tech companies.

Bundeskartellamt officials said Facebook could continue to collect data via each service, but this user data must be kept separate and cannot be merged with existing Facebook profiles unless the company obtains explicit user consent.

The anti-trust watchdog also forbade Facebook from denying users access to its services unless they consent to having their activity tracked outside of the main site.

“In future, Facebook will no longer be allowed to force its users to agree to the practically unrestricted collection and assigning of non-Facebook data to their Facebook user accounts,” said Andreas Mundt, President of the Bundeskartellamt, in a press release today [EN/DE].

“The combination of data sources substantially contributed to the fact that Facebook was able to build a unique database for each individual user and thus to gain market power,” Mundt added.

Bundeskartellamt published a report [EN/DE] detailing their findings and how Facebook’s unrestricted user data collection has helped the company gain a leg up on its competition over the years, allowing it to establish a dominant, almost impossible to surpass market position.

The report is the result of a nearly three-year investigation into Facebook’s user data collection practices that the German agency started in March 2016.

“While we’ve cooperated with the Bundeskartellamt for nearly three years and will continue our discussions, we disagree with their conclusions and intend to appeal so that people in Germany continue to benefit fully from all our services,” Facebook said today in a blog post.

Facebook argued that the agency misapplied German anti-competition law in its case. The company argued that its data collection practices fall under privacy laws and the new EU GDPR directive, rather than anti-trust law.

“Popularity is not dominance,” Facebook said, also arguing that while it is a social network, its diverse features put it in direct competition with all kinds of niche services at the same time, hence the reason to collect so much data.

Facebook has a month to appeal the decision in a German court. The Bundeskartellamt decision has no legal enforcing power behind it, just yet. According to the agency’s report, the Bundeskartellamt would like Facebook to come up with “an implementation plan” to address the issues it found.

However, if Facebook will not comply, “decisions of the Bundeskartellamt can also be legally enforced by means of certain enforcement measures,” the report said.

“These include the possibility to impose a fine (max. 10 per cent annual turnover) or periodic penalty payments (max. 10 million euros per penalty payment) which can be imposed at specific intervals (e.g. monthly).”